What is Watermarking?
Also called AI Watermarking, Output Watermarking.
Watermarking is the embedding of a detectable signal into AI generated content so that its machine origin can later be identified. For images and audio the signal is imperceptible modification of the media; for text it is usually a statistical bias applied during token selection. Robustness against editing and paraphrasing remains a significant and actively researched limitation.
Text watermarking typically works by pseudorandomly partitioning the vocabulary at each step using a secret key and nudging generation toward one partition. Across enough tokens this produces a statistical signature detectable by anyone holding the key, while individual sentences look unremarkable. Detection strength grows with length, so short passages are difficult to attribute with confidence.
The central weakness is removal. Paraphrasing, translation, mixing generated and human written text, or moderate editing can weaken or destroy a text watermark, and image watermarks face compression, cropping and regeneration. Stronger embedding preserves detectability but risks visible artifacts or reduced output quality, and published attacks and defenses have continued to trade places.
Watermarking is also inherently voluntary at the source. It can only be applied by the system generating the content, so models run by parties uninterested in labeling their output simply omit it. This limits its usefulness for detecting deliberately deceptive content, while leaving real value for platform level labeling, dataset hygiene and reducing accidental recycling of synthetic text into training corpora.
Policy interest is substantial. The EU AI Act includes transparency obligations requiring that synthetic content be marked in machine readable form, and various jurisdictions have proposed or adopted disclosure requirements for synthetic media. How these interact with detection reliability, false positives and open weight models remains unsettled, and detection claims should be treated as probabilistic rather than definitive.
Key points
- Embeds a detectable signal into generated text, image or audio
- Text watermarks bias token selection using a secret key
- Paraphrasing, editing and compression can remove the signal
- Only works when the generating system chooses to apply it
- Detection is probabilistic, not proof of origin
In practice
A publishing platform applies a watermark to images produced by its own generation feature and checks uploads for the same signal, labeling matches as AI generated. The check catches unedited reposts reliably, weakens on heavily cropped and recompressed versions, and finds nothing in images generated elsewhere. The team therefore treats a detection as evidence for labeling, and treats absence of detection as no information at all.